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CLAIMS: 

1 . A method for determining network topology, comprising: 
capturing and storing channelized data with a network analyzer; 
interleaving the channelized data into a unitary data stream in chronological 

order; and 

processing the unitary data stream to extrapolate indicators of network 
elements. 

2. The method of claim 1, wherein processing the unitary data stream further 
comprises determining a left and right topology from the network analyzer. 

3. The method of claim 2, further comprising analyzing ordered sets, source and 
destination IDs, and ordering of events in the unitary data trace to determine the 
presence of network elements. 

4. The method of claim 3, further comprising analyzing open and close 
commands in the unitary data trace to determine the presence of a loop. 

5. The method of claim 3, further comprising analyzing device addresses in the 
unitary data trace to determine the presence of switches. 

6. The method of claim 3, further comprising analyzing ordering of events in the 
unitary data trace to determine the presence of stealth mode switches. 

7. A method for determining network topology during a network analysis 
process, comprising: 

positioning at least one network analyzer in communication with the network; 
capturing trace data from a first and second channel on each of the 
analyzers; 
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determining a first topology corresponding to the first channel of each 
analyzer; 

determining a second topology corresponding to the second channel of each 
analyzer; 

combining the first and second topologies from each of the analyzers; and 
deleting duplicate topology entries from the combined topology to generate 
the network topology. 

8. The method of claim 7, wherein positioning the at least one network analyzer 
further comprises positioning the analyzers such that bidirectional communication 
between each network element may be captured in a data trace. 

9. The method of claim 7, wherein capturing trace data further comprises storing 
channelized data for subsequent processing. 

10. The method of claim 7, wherein determining the first and second topology 
comprises analyzing ordered sets, source and destination identifications, device 
addresses, and ordering of events in the trace data to determine the presence of 
network elements that correspond to the ordered sets, source and destination 
identifications, and device addresses. 

11. The method of claim 10, further comprising analyzing open and close 
commands in the trace data to determine the presence of a loop on the network. 

12. The method of claim 10, further comprising analyzing device addresses in the 
trace data to determine the presence of switches on the network. 

13. The method of claim 10, further comprising analyzing ordering of events in 
the trace data to determine the presence of stealth mode switches on the network. 
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14. The method of claim 7, further comprising displaying the network topology to 
a user via a graphical user interface. 

15. A method for analyzing a network to determine the topology of the network, 
comprising: 

positioning at least one analyzer in communication with the network; 

capturing a left channel and a right channel data trace from each of the at 
least one analyzers; 

extrapolating network device presence indicators from the left and right 
channel data; and 

determining the network topology from the network device indicators; and 
displaying the determined network topology to a user. 

16. The method of claim 15, further comprising combining the left and right 
channel data into a unitary data stream. 

17. The method of claim 16, wherein determining the network topology comprises 
determining a left topology and a right topology for each of the at least one 
analyzers and combining the left and right topologies to determine an overall 
topology. 

18. The method of claim 15, wherein determining the network topology comprises 
analyzing ordered sets, source and destination identifications, device addresses, 
and ordering of events in the data trace to determine the presence of network 
devices that correspond to the ordered sets, source and destination identifications, 
and device addresses. 

19. The method of claim 18, wherein the ordered sets are analyzed to determine 
the presence of loops on the network. 
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20. The method of claim 18, wherein the device addresses are analyzed to 
determine the presence of switches on the network. 

21. The method of claim 18, wherein ordering of events is analyzed to determine 
the presence of stealth mode switches on the network. 
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